Fix double frees and memory leaks.

* src/roff/troff/env.cpp (environment::make_tag): Use local object.
* src/roff/troff/input.cpp (input_stack::check_end_diversion): Free
`diversion_state' here.
(interpolate_arg): Fix memory leaks.
* src/roff/troff/mtsm.cpp (mtsm::pop_state): Don't free `sp->state'.

3 files changed, 12 insertions, 8 deletions

diff --git a/src/roff/troff/env.cpp b/src/roff/troff/env.cpp
index 56bfe21d..13672cc5 100644
--- a/src/roff/troff/env.cpp
+++ b/src/roff/troff/env.cpp
@@ -2213,14 +2213,15 @@ node *environment::make_tag(const char *nm, int i)
      */
     if (curdiv == topdiv && topdiv->before_first_page)
       topdiv->begin_page();
-    macro *m = new macro;
-    m->append_str("devtag:");
+
+    macro m;
+    m.append_str("devtag:");
     for (const char *p = nm; *p; p++)
       if (!invalid_input_char((unsigned char)*p))
-	m->append(*p);
-    m->append(' ');
-    m->append_int(i);
-    return new special_node(*m);
+	m.append(*p);
+    m.append(' ');
+    m.append_int(i);
+    return new special_node(m);
   }
   return 0;
 }
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index 17d24515..7c816e83 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -531,6 +531,8 @@ void input_stack::check_end_diversion(input_iterator *t)
 {
   if (t->is_diversion) {
     div_level--;
+    if (diversion_state)
+      delete diversion_state;
     diversion_state = t->diversion_state;
   }
 }
@@ -4398,6 +4400,7 @@ static void interpolate_arg(symbol nm)
 	  args += c;
       if (i != limit)
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
@@ -4419,6 +4422,7 @@ static void interpolate_arg(symbol nm)
       args += '"';
       if (i != limit)
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
@@ -4438,6 +4442,7 @@ static void interpolate_arg(symbol nm)
       }
       if (input_stack::space_follows_arg(i))
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
diff --git a/src/roff/troff/mtsm.cpp b/src/roff/troff/mtsm.cpp
index 83a69066..79e2f78f 100644
--- a/src/roff/troff/mtsm.cpp
+++ b/src/roff/troff/mtsm.cpp
@@ -390,8 +390,6 @@ void mtsm::pop_state()
 #endif
     if (sp == 0)
       fatal("empty state machine stack");
-    if (sp->state)
-      delete sp->state;
     sp->state = 0;
     stack *t = sp;
     sp = sp->next;